psample

package
v0.0.0-...-8d377ce Latest Latest
Warning

This package is not in the latest version of its module.

Go to latest
Published: Mar 29, 2024 License: Apache-2.0 Imports: 3 Imported by: 0

Documentation

Overview

Package psample provides a receiver for sampled network packets using the Netlink psample interface.

Index

Constants

This section is empty.

Variables

This section is empty.

Functions

func Subscribe

func Subscribe() (*genetlink.Conn, error)

Subscribe returns a NetlinkSocket that's already subscribed to "packets" psample multicast group, which makes it ready to receive packet samples. Close should be called on the returned socket.

Types

type Packet

type Packet struct {
	// IncomingInterfaceIndex is the incoming interface index of the packet or 0
	// if not applicable.
	IncomingInterfaceIndex uint16
	// OutgoingInterfaceIndex is the outgoing interface index of the packet or 0
	// if not applicable.
	OutgoingInterfaceIndex uint16
	// OriginalSize is the packet's original size in bytes without any
	// truncation.
	OriginalSize uint32
	// SampleGroup is the sample group to which this packet belongs. This is set
	// by the sampling action and can be used to differentiate different
	// sampling streams.
	SampleGroup uint32
	// GroupSequence is a monotonically-increasing counter of packets sampled
	// for each sample group.
	GroupSequence uint32
	// SampleRate is the sampling rate (1 in SampleRate packets) used to capture
	// this packet.
	SampleRate uint32
	// Data contains the packet data up to the specified size for truncation.
	Data []byte

	// Latency is the sampled packet's latency as indicated by psample. It's
	// expressed in nanoseconds.
	Latency uint64
	// Timestamp marks time of the packet's sampling. It's set by the kernel, and
	// expressed in Unix nanoseconds.
	Timestamp uint64
}

Packet contains the sampled packet in its raw form, along with its 'psample' metadata.

func Receive

func Receive(c *genetlink.Conn) ([]Packet, error)

Receive returns one or more of the sampled packets as soon as they're available. It may return a syscall.ENOBUFS error which indicates that the kernel-side buffer of the netlink connection has overflowed and lost packets. This is a transient error, calling Receive again will retrieve future packet samples.

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL